Cybersecurity Policy Report, Judge Tentatively OKs AT&T’s $177M Class-Action Data Breach Settlement, (Jun 20, 2025)
Organizations Mentioned:AT&T
A federal judge today tentatively agreed that AT&T should pay $177 million to settle a class-action lawsuit that arose from two separate data breaches at the carrier.
Judge Ada Brown of the U.S. District Court for the Northern District of Texas issued a preliminary approval order that said the settlement agreement was “fair, reasonable, and adequate, and in the best interest of the named Plaintiffs and the Settlement Classes.”
The settlement includes a $149 million payout for a March 2024 data breach and another $28 million for a July 2024 breach, according to documents in the case, In Re: AT&T Inc Customer Data Security Breach Litigation, No. 24-cv-00757 (N.D. Tex. Mar. 30, 2024).
The March 2024 data breach exposed the personal information of 7.6 million current AT&T account holders and 65.4 million former account holders, AT&T said, including names, e-mail addresses, phone numbers, Social Security numbers, birth dates, and account numbers but not personal financial information or call history (CPR, April 1, 2024).
But much of the data involved in that breach was not current, the company noted.
A more consequential breach that occurred in July 2024 exposed records of calls and texts of “nearly all of AT&T’s cellular customers,” the carrier said at the time (CPR, July 12, 2024).
The later breach resulted from a cyber attack on an AT&T business partner, Snowflake, Inc., which faces a separate class-action lawsuit in Montana.
The judge scheduled a Dec. 3 hearing to give final approval to the settlement and “determine whether the proposed plan of allocation and distribution of the Settlement Fund is fair and reasonable and should be approved.”
News: FederalLegislation LitigationEnforcement DataBreach DataSecurity